Update Felix configuration guide to include iptables lock file support. #935
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fasaxc
added
the
release-note-required
3 tasks
fasaxc
changed the title
nelljerram
requested changes
Jul 20, 2017
| | MaxIpsetSize | FELIX_MAXIPSETSIZE | 1048576 | Maximum size for the ipsets used by Felix to implement tags. Should be set to a number that is greater than the maximum number of IP addresses that are ever expected in a tag. | | ||
| | IptablesLockTimeoutSecs | FELIX_IPTABLESLOCKTIMEOUTSECS | 0 (disabled) | Time, in seconds, that Felix will wait for the iptables lock, or 0, to disable. To use this feature, Felix must share the iptables lock file with all other processes that also take the lock. When running Felix inside a container, this requires the /run directory of the host to be mounted into the calico/node or calico/felix container. | | ||
| | IptablesLockFilePath | FELIX_IPTABLESLOCKFILEPATH | /run/xtables.lock | Location of the iptables lock file. You may need to change this if the lock file is not in its standard location (for example if you have mapped it into Felix's container at a different path). | | ||
| | IptablesLockProbeIntervalMillis | FELIX_IPTABLESLOCKPROBEINTERVALMILLIS | 50 | Time, in milliseconds, that Felix will wait between attempts to acquire the iptables lock if it is not available. Lower values make Felix more responsive when the lock is contended but use more CPU. | |
There was a problem hiding this comment.
I think a comma is needed before "but".
| | IptablesMarkMask | FELIX_IPTABLESMARKMASK | 0xff000000 | Mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal number with at least 8 bits set, none of which clash with any other mark bits in use on the system. | | ||
| | IptablesRefreshInterval | FELIX_IPTABLESREFRESHINTERVAL | 60 | Period, in seconds, at which felix re-applies all iptables state to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable iptables refresh. | | ||
| | IptablesRefreshInterval | FELIX_IPTABLESREFRESHINTERVAL | 90 | Period, in seconds, at which felix re-checks all iptables state to ensure that no other process has accidentally broken Calico's rules. Set to 0 to disable iptables refresh. | | ||
| | IptablesPostWriteCheckIntervalSecs | FELIX_IPTABLESPOSTWRITECHECKINTERVALSECS | 1 | Period, in seconds, after Felix has done a write to the dataplane that it schedules an extra read back in order to check the write was not clobbered by another process. This should only occur if another application on the system doesn't respect the iptables lock. | |
There was a problem hiding this comment.
Can we make Felix capitalization consistent? (I have a slight preference for "Felix", but am more concerned overall that we are consistent.)
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Simplified version of #902 reflecting that we're disabling the lock file by default. Doesn't include the manifest changes.
Todos
Release Note